TDSCSA00699-02: Vulnerability found related to Unquoted Search Path or Element

April 28, 2020
Toshiba Electronic Devices & Storage Corporation

Overview

There is a potential vulnerability within three backup and security software applications for the Toshiba Canvio external HDD product. Toshiba is advising customers who have installed the software to update to the new versions provided on our web site.

Affected application software and products

The following applications (which run under Windows) are affected:
Storage Backup Software, Storage Security Software and HDD Password tool (the "Applications").
The Applications run on the external HDD products as listed below. These Applications are designed to be used with these specific HDD products, but if you use them with other products, we advise that you take measures as  "Solutions" below.

Application software

Version

Products(P/N)

Storage Backup Software

1.30.9116 or earlier 

CANVIO™ ADVANCE (HDTC9******A)

CANVIO™ ALU / ALUMY (HDTH3******B)

CANVIO™ PREMIUM (HDTW2******A)

CANVIO™ SLIM (HDTD3******A)

Storage Security Software

1.30.8604 or earlier

HDD Password tool

(for Windows)

1.20.6620 or earlier

CANVIO™ SLIM (HDTD1******* / HDTD2*******)

CANVIO™ PREMIUM (HDTW1*******)

Note: An asterisk mark (*) is an alphanumeric character.

Impact

Each Application uses a search path that contains an unquoted element, consisting of whitespace or other separators. This can cause the product to access resources in a parent path, possibly allowing local privilege escalation.

Solutions

1) For Storage Backup Software and Storage Security Software

Customers who have installed previous versions of the Applications are advised not to run them. Please download the latest versions of the Applications from the following link.
If you use them with the products as listed, we advise you carry on "#1 Preparation before Update" and "#2-a Update Storage Backup Software and/or Storage Security Software" then "#3 Remove previous installer".  

But if you use them with other products than the products as listed above, we advise that you only carry on "#2-b Uninstall Storage Backup Software and/or Storage Security Software" and "#3 Remove previous installer" in below, and do not download a new update software.

Important: Please review and follow these steps carefully for the update.

#1 Preparation before Update

  • Before updating the Storage Security Software, if you own a password-protected HDD with the software, please delete the password before uninstalling.

  • For both Storage Backup Software and Storage Security Software, please be sure to back up all data on the device to another computer or storage media before updating.

#2-a Update Storage Backup Software and/or Storage Security Software
When you connect the device to a computer on which the old version software is installed, the launcher will present you with an option to update the software.

#2-b Uninstall Storage Backup Software and/or Storage Security Software
Please uninstall Storage Backup Software and/or Storage Security Software.

#3 Remove previous installer 
Please remove all previous versions of the installer file from the product or PC.

Software

Version

Release

Date

Update Classification*1

OS Compatibility *4

Download

Storage Backup Software

1.40.0410

April 20,

2020

Important

Windows 8.1 *2

(32bit & 64bit)

 

Windows 10 *3

Version 1809 /

Version 1903 /

Version 1909

(32bit & 64bit)

Link to download page

Storage Security Software

1.40.0410

It is strongly recommended that you update this software.

 

Note

  • Company names, product names, and service names may be trademarks of their respective companies.
  • Software support language: English, Simplified Chinese, German, Spanish, French, Italian, Portuguese, Japanese
  • Manual support language: English, German, Spanish, French, Italian, Portuguese.

*1 Update Classification: means Necessarily of update.

*2 Excludes Windows RT 8.1 and Windows 8.1 Enterprise Edition.

*3 Excludes Education, Pro Education, Windows 10 S, Windows 10 Mobile, Enterprise and Enterprise LTSB Edition.

*4 Toshiba has ended the support for the Windows OS versions for which Microsoft Corporation in the United States has ended the support.

2) For HDD Password tool

Customers who have installed previous versions of the HDD Password tool are advised not to run it. Please download and install the latest version from the following link.

If you use them with the products as listed, we advise you carry on “#1 Preparation before Update” and “#2-a Update HDD Password Tool” then #3 Remove previous installer”.

But if you use them with other products than the products as listed above, we advise that you only carry on “#2-b Uninstall HDD Password Tool” and “#3 Remove previous installer” in below, and do not download a new update software.

Important: Please review and follow these steps carefully for the update.

#1 Preparation before Update
If you own password-protected HDD with the software, please delete the password before uninstalling.

#2-a Update HDD Password tool
Please download the latest version and install this.

#2-b Uninstall HDD Password tool
Please uninstall HDD Password tool.

#3 Remove previous installer 
Please remove the previous version of the installer from the product or PC.

Software

Version

Release

Date

Update Classification*1

OS Compatibility*4

Download

Manual

Release Note

HDD Password tool

1.40.0410

 

April 28,

2020

Important

 

Windows 8.1 *2

(32bit & 64bit)

 

Windows 10 *3

Version 1809 /

Version 1903 /

Version 1909

(32bit & 64bit)

Type 1*5

EXE:

(8.55 MB)

Type 2*5

EXE:

(11.1 MB)

 

PDF:

(701 KB)

PDF:

(10.7 KB)

It is strongly recommended that you update this software.

 

Note

- Company names, product names, and service names may be trademarks of their respective companies.

*1 Update Classification means necessarily of update.
*2 Exclude Windows RT 8.1 and Windows 8.1 Enterprise Edition.
*3 Excludes Education, Pro Education, Windows 10 S, Windows 10 Mobile, Enterprise and Enterprise LTSB Edition.
*4 Toshiba has ended the support for Windows OS versions for which Microsoft Corporation in the United States has ended the support.
*5 Software support language:

- There are two types of software, depending on the region. Please download the software corresponding to your region.

Type 1: Americas region / English, Canadian French, Portuguese (Brazilian) and Spanish (Latin American)

Type 2:  Europe, Asia region / Chinese (Simplified), Chinese (Traditional), Korean, Japanese, English, German, French, Spanish (International), Italian, Polish, Portuguese, Russian and Turkish.

- Manual support language: English

History

Date
April 20, 2020  (PDF: 683KB)
April 28, 2020 (Last Updated)

Contact Information

Please visit the following website and choose the Consumer Storage Solutions website in your region.

Consumer Storage

A new window will open